Does PP TUNAS Apply to Your Kids Activity Centre's Website?

The coverage stopped at the consumer half

On 28 Maret 2026 the accounts of users under sixteen started being switched off on services carrying a profil risiko tinggi, and Kepmen Komdigi 140/2026 carries the Lampiran naming the eight services in that category. That is the story that ran everywhere, and it is a story about very large platforms.

The rule underneath it is not written that way. PP 17/2025 was ditetapkan and diundangkan on the same day, 27 Maret 2025, and recorded in Lembaran Negara Tahun 2025 Nomor 36. Its Pasal 50 says the regulation mulai berlaku pada tanggal diundangkan, so it has been operative for well over a year already. Nothing in it addresses itself to platforms. It addresses itself to a Penyelenggara Sistem Elektronik, and the definition of that term is where a small Indonesian centre finds itself in scope.

One correction is worth making first, because the widely repeated version is wrong in a way that matters. Pasal 21 ayat (1) does not ban children from having accounts. It sets three positions. A child under 13 may hold an account on a product specifically designed for children with a low risk profile, with parental consent. A child from 13 to under 16 may hold one only where the risk profile is low, with parental consent. A child from 16 to under 18 may hold one, with parental consent. Every tier turns on persetujuan orang tua, and none of the three is a prohibition. The under sixteen deactivations followed from the high risk classification of particular services, not from a blanket age ban.

That distinction is the whole reason this reaches ordinary businesses. The regulation is not a list of banned platforms. It is a set of duties that attach to whoever is running the service.

Does PP TUNAS apply to a centre with one website?

Read the definition and it is difficult to construct a version of a kids activity business that sits outside it.

Pasal 1 of the regulation is the definitions article. Angka 4 defines a Penyelenggara Sistem Elektronik as setiap orang, penyelenggara negara, badan usaha, dan masyarakat yang menyediakan, mengelola, dan/atau mengoperasikan Sistem Elektronik. There is no revenue floor, no headcount, no user count, and no carve out for a business with a single location. Angka 5 defines Produk, Layanan, dan Fitur just as broadly, as anything a Penyelenggara Sistem Elektronik develops or runs yang terhubung dengan internet atau memiliki kemampuan untuk terhubung dengan internet.

The scoping question then moves to Pasal 3 ayat (3), which defines a Penyelenggara Sistem Elektronik lingkup privat as one running Produk, Layanan, dan Fitur yang secara khusus dirancang untuk digunakan atau diakses oleh Anak, atau yang mungkin digunakan atau diakses oleh Anak. That second limb is the one to watch. It is not about who you designed the thing for. It is about who might reach it.

Pasal 4 ayat (2) sets out what evidence counts for that second limb. Published or internal terms showing the product is meant to be used by children. Strong evidence that the routine user composition is children. Advertising aimed at children. Design elements presented so as to be attractive for children to use. Substantial similarity to a product already proven to be used by children. Ayat (3) then leaves the assessment indicators themselves to a Keputusan Menteri, and that decision arrived as Kepmen Komdigi 142/2026, ditetapkan 17 Maret 2026 and effective the same day.

Its Lampiran I carries the sentence that settles the argument for most centres. Pemenuhan terhadap salah satu indikator dinilai telah cukup untuk menetapkan bahwa produk, layanan, dan fitur termasuk dalam kategori yang mungkin digunakan atau diakses oleh anak. Meeting one indicator is enough. Not a majority, not a balance of them. One.

Having no terms of service is the trap, not the escape

The indicator most centres will meet is the first one, and the way the official worksheet reaches that conclusion is genuinely counter intuitive.

Kepmen Komdigi 142/2026 Lampiran I turns each indicator into a short decision table. For the terms and policy indicator the first question asks whether published or internal terms show the product is meant to be used or accessed by children. An answer of Iya records Indikator terpenuhi immediately. So far, so expected.

The second question is the interesting one. It asks whether terms, conditions, rules or policies relating to the product exist at all. An answer of Tidak, meaning you have none, also records Indikator terpenuhi. Having no published policy is not neutral in this scheme and it is not a defence. It counts against you in exactly the same column as having one that welcomes children.

The table then asks at angka 3 whether all the terms regulate child users, and finally at angka 4 whether all the terms prohibit child users from using or accessing the product. Only an unqualified yes at that last step records Indikator tidak terpenuhi. Everything else lands on terpenuhi.

Set that against how a real centre operates. To clear the indicator, a business whose entire purpose is children would have to publish terms that prohibit children from using its own service, and prohibit them completely rather than partially. For a swim school, a bimbel or a music studio that is not a compliance exercise, it is a contradiction. And even a centre that somehow managed it would still face the advertising and design indicators separately, since one indicator is enough on its own.

There is a limit here worth naming rather than smoothing over. Neither document says in terms how a brochure style website with no logins and no accounts should be treated, as distinct from a portal a child signs into. The definition in Pasal 1 angka 5 is broad enough on its face to cover an ordinary website, and the indicators are written about products rather than about accounts, but the documents do not resolve the point and this article is not going to invent an answer to it. What can be said plainly is that a centre running a student portal, a class booking flow, an app, or any surface a child logs into is squarely inside the definition, and that the further a business sits from that description the more it is relying on an argument nobody has tested.

What is the penilaian mandiri, and what has to be in it?

It is a written self assessment, it is compulsory, and its timing rule catches most people by surprise.

Pasal 5 ayat (6) of the regulation uses the word wajib. The operator must assess its own product against the aspects in ayat (3), and there are seven of them: contact with unknown persons, exposure to pornographic, violent or life threatening content, exploitation of the child as a consumer, threats to the security of the child's personal data, addiction, psychological harm, and physiological harm. Ayat (4) makes the scoring unforgiving. A high score on one or more aspects puts the whole product into profil risiko tinggi, and a low profile requires a low score on every single aspect. Ayat (7) requires the result to be reported to the Menteri, and ayat (9) leaves the final profil risiko to be set by the Menteri rather than by the operator.

Permen Komdigi 9/2026 fills in what the document has to contain. Its Pasal 4 ayat (2) sets three minimum elements: consideration of children's needs across the declared age bands, consideration of the risks arising from the product meeting those needs, and involvement of parties both inside and outside the operator's organisation. That third element is easy to skip and hard to reconstruct afterwards, because it is about who was in the room. Ayat (3) requires the result and every change to it to be documented.

Then comes the timing rule. Pasal 5 ayat (2) of the same Permen requires the documentation to be ratified by the operator before the product can be accessed by a child. Not afterwards, and not on request. Ayat (3) requires it to be updated whenever the underlying needs or risks change, and ayat (4) requires it to be kept for as long as the product remains reachable by a child.

The age declaration sits alongside it. Pasal 20 ayat (2) of the regulation puts the floor for a declared minimum age at 3 years and fixes five bands: 3 to 5, 6 to 9, 10 to 12, 13 to 15, and 16 to below 18. Permen Komdigi 9/2026 Pasal 2 repeats those bands and adds at ayat (6) that an operator tidak menargetkan its product at children below age 3. Pasal 3 ayat (1) requires the declared age to be published dalam bahasa yang mudah dipahami and in a form the child and the parent can actually reach, and ayat (5) requires the operator to keep documentation of that declaration and of every change to it.

Two more duties attach where the product does more than publish information. Pasal 10 ayat (2) requires teknologi kontrol orang tua wherever the product lets a child come into contact with unknown persons, with ayat (3) making that control the route by which a parent grants or withholds consent. And Pasal 22 ayat (3) of the regulation governs age verification itself: process the data only for verification, delete it once the purpose is met unless the law requires retention, and give users a way to object to a wrong age decision. An enrolment form that quietly keeps a copy of a family card to prove a child's age is doing the opposite of what that article requires.

The report was due 6 Juni 2026. What happens to a centre that missed it?

The deadline is in the implementing regulation rather than the parent one, which is part of why it went unnoticed.

Permen Komdigi 9/2026 was ditetapkan and diundangkan on 6 Maret 2026, recorded in Berita Negara Tahun 2026 Nomor 163, and runs to 29 halaman. Its Pasal 62 requires the penilaian mandiri report to reach the Menteri through the Direktur Jenderal paling lambat 3 bulan sejak Peraturan Menteri ini diundangkan. Three months from 6 Maret 2026 is 6 Juni 2026. That date has passed.

Here is the tension the sources do not resolve, and it deserves to be stated rather than papered over. Pasal 49 of the regulation, the ketentuan peralihan, gives operators paling lama 2 tahun sejak Peraturan Pemerintah ini diundangkan to bring themselves into line, which from 27 Maret 2025 runs to 27 Maret 2027. Paling lama is a ceiling rather than a grant, so a shorter clock set by the Menteri is not on its face inconsistent with it. But an operator who read Pasal 49 in good faith last year and diarised 2027 has now missed a reporting date in a Permen that did not exist when they read it. What follows for that operator is not answered by either document, and guessing at it would be worse than saying so.

What the documents do say about the report is exacting. Pasal 21 ayat (2) of the Permen makes the operator legally responsible for the report being benar, akurat, lengkap, dan tidak menyesatkan, and ayat (3) requires a named official inside the organisation to act as narahubung. Pasal 22 provides that false or misleading information in the report may be weighed by the Menteri when judging compliance, when imposing administrative sanctions, and when deciding whether to report the operator to law enforcement. Pasal 24 ayat (3) closes the other route out: an operator who does not answer the Direktur Jenderal's request for clarification within the time set is declared not to have met the self assessment duty at all, and ayat (4) sends it back to start again.

There is one more moving part. Kepmen Komdigi 219/2026, ditetapkan 7 Mei 2026 and effective the same day, amended Lampiran II of Kepmen Komdigi 142/2026, rewriting the parameter coded GF01 under the physiological harm aspect and reworking the self assessment worksheet. That change landed inside the reporting window it governs, so an assessment scored in the weeks after the Permen appeared was scored against a guide that was replaced before the filing date. Its Diktum KEDUA also hands the Direktur Jenderal Pengawasan Ruang Digital a standing mandate to make further changes atas nama the Menteri, which means the next revision need not arrive as a ministerial decision at all. Anyone treating this as a document to write once has misread the shape of it.

The sanctions reach almost every duty in this list

Pasal 38 ayat (1) of the regulation lists the provisions that carry administrative sanctions, and the list reaches most of what has been described above. Pasal 2, the general protection duty. Pasal 5 ayat (6), the self assessment. Pasal 20 ayat (1) and ayat (3), the declared minimum age. Pasal 21 ayat (1) and ayat (2), the account age rules and the parental supervision technology. Pasal 22, the verification mechanism.

Ayat (2) sets out four sanctions: teguran tertulis, denda administratif, penghentian sementara, dan pemutusan akses. A written warning, an administrative fine, temporary suspension, and termination of access. No monetary amount for the fine appears anywhere in the regulation, and this article is not going to supply one; where the figure comes from is a question for the ministry's own implementing material rather than for these documents.

For a small business the fourth sanction is not the one to worry about most. Ayat (4) gives the Menteri the power to announce an administrative sanction against a named Penyelenggara Sistem Elektronik to the public through the ministry's official website. For a business whose customers are parents, a publicly listed child protection sanction is a different order of problem from a fine. That is what the article permits, not a prediction that it will be used against small operators, and the distinction matters. But it is the reason this is worth a morning of attention rather than a shrug.

It is also worth being straight about what software does and does not do here. This filing is not something Happy Kamper produces for a centre. The penilaian mandiri is the operator's own document about the operator's own service, it has to be ratified by the operator under Pasal 5 ayat (2) of the Permen, and Pasal 21 ayat (3) requires a person inside that organisation to put their name to it as narahubung. No vendor can hold that pen.

What can a centre do about this in one working week?

The work divides into things that are written down and things that are configured, and the written ones come first because the regulation asks for documents.

Start by writing the age declaration. Pick the band from the five in Pasal 20 ayat (2) that matches who the service is actually for, publish it somewhere a parent will find it in plain language as Pasal 3 ayat (1) of the Permen requires, and keep the record of what you published and when.

Then publish terms. This is the counter intuitive step and the one with the clearest payoff, because under the Kepmen Komdigi 142/2026 table the absence of any policy is itself a finding. Terms that describe honestly how children use the service are better evidence than silence, and silence buys nothing.

Then write the self assessment against the seven aspects in Pasal 5 ayat (3), include the three elements Pasal 4 ayat (2) of the Permen requires, get someone outside the business into that conversation so the third element is real, ratify it, date it, and file it. Name your narahubung while you are there.

On the configuration side, check whether any part of the service puts a child in contact with someone they do not know, because that triggers the parental control duty in Pasal 10 ayat (2). Check what you collect to verify a child's age and what happens to it afterwards, against Pasal 22 ayat (3). And make sure there is a working route for a parent to report misuse, which Pasal 2 ayat (4) requires alongside the age information and the verification mechanism.

A centre already thinking carefully about what it publishes about children has done part of this without knowing it. The consent and personal data side of the same problem is covered separately in the photo consent and personal data guide, and the practical question of which digital surfaces a centre puts in front of families at all is discussed on the parent communications page. For centres in the early years bracket specifically, the operational context sits with early education, and the coding and screen based end of the market is where the platform level classifications in Kepmen Komdigi 140/2026 start to touch what happens in class, as set out in what children learn in Roblox coding classes.

The things worth carrying out of this are few. The rule reaches any business running an internet connected service, not just large platforms, because Pasal 1 angka 4 sets no size threshold. Meeting one indicator in Kepmen Komdigi 142/2026 is enough to be in scope, and having no published terms is one of the ways to meet it. The self assessment is compulsory under Pasal 5 ayat (6), has to be ratified before children can reach the service, and had a reporting date of 6 Juni 2026 that has already gone. The age rules in Pasal 21 ayat (1) are consent rules rather than bans. And the guidance underneath all of it moved once already on 7 Mei 2026, with a standing mandate for it to move again.